Description
A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VITA-MLLM | Freeze-Omni | 20250421 | — |
References
- VDB-308999 | VITA-MLLM Freeze-Omni utils.py torch.load deserialization vdb-entry technical-description
- VDB-308999 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #567796 | VITA-MLLM Freeze-Omni 0.0 Deserialization third-party-advisory
- https://github.com/VITA-MLLM/Freeze-Omni/issues/29 issue-tracking